Privacy policy
Last updated: 16 October 2026
This policy covers the Enhanced Training Studio app and this website, run by Adam White from Australia. The short version: your health and training data stays on your phone, and we never receive it.
We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) for everything described here.
What stays on your phone
Everything you log in the app stays on your phone: compounds, doses, schedules, blood test results, workouts, routes, data read from Health Connect, and your profile. We have no copy and can't see it. Apart from the anonymous usage count below, which is off until you allow it, the free edition doesn't contact our servers, and the full app only does so to check your licence and look for updates.
What we do receive
| What | Why | How long |
|---|---|---|
| Licence key, a random device ID, device name and app version, when you activate and when the app checks in every few days | To activate your licence and manage your 3 device slots | While your licence exists |
| Order details (amount, time, invoice or order number) | To issue your licence and for tax records | 5 years, as Australian tax law requires |
| Bitcoin: your email, only if you give it at checkout | For BTCPay's payment notice, and to help find your order if you contact support | Until you ask us to delete it |
| Card: the name, email and country you give Lemon Squeezy at checkout, which we can see in our Lemon Squeezy account. We never see your card details | To help find your order if you contact support, and for refunds | 5 years, with our payment records |
| Referrals: which licence's code was used for which purchase, and the reward status | To give the referrer their reward and cancel it if the purchase is refunded | While either licence exists |
| The bitcoin address you enter to claim a referral reward | To send you the reward (it's entered on our BTCPay Server) | 5 years, with our payment records |
| An anonymous usage count, at most once a day, only if you tap Allow when the app asks (nothing is sent until you do): which app (free edition, full app, licensed or web app) and its version, how many of the last 7 and 28 days the app was opened, roughly how long ago it was installed, and whether this is the phone's first count, first this week and first this month. There's no device ID, licence key or anything you've logged in it | To know how many phones use the app and how often | The individual count isn't kept: it's only added to daily totals |
| Your IP address, briefly, when you use the website or the app checks in | Security and to stop abuse (rate limits) | Not stored by us; our host keeps standard logs for a short time |
We don't collect health information. We don't use advertising, tracking cookies or any third-party analytics, and we don't sell, rent or share personal information. The usage count above is our own, can't be linked to you, is off until you allow it, and you can turn it on or off at any time in the app under Setup > App settings > Usage count. You can see exactly what it sends there too.
Who else is involved
- Cloudflare hosts this website and our licence server. Its servers are in many countries, including the United States, so your IP address and the licence details above may be processed overseas.
- GitHub (United States) hosts the free edition's source code and our F-Droid repository. If you download the app from GitHub or through F-Droid, GitHub sees your IP address, like any website you download from. The F-Droid app itself doesn't send us anything.
- LunaNode (Canada) hosts our own BTCPay Server, which handles bitcoin payments. No payment company is involved, and we don't ask for your name or address.
- A Bitcoin payment is recorded publicly on the blockchain by its nature. We don't link it to anything beyond your order.
- Lemon Squeezy (United States) handles card payments where we offer them, as our reseller (merchant of record): it sells you the licence, takes the payment and handles sales tax. It collects your card details, email and billing address under its own privacy policy, and tells us only what's in the table above. If you'd rather not share these, pay with bitcoin.
We choose providers that protect data with encryption and access controls, and they may only use it to provide their service to us.
On-device AI
In the full app on supported Android phones (such as a Pixel 9 or newer), you can turn on on-device AI: Gemini Nano reads lab reports and labels, fills in a dose or a workout from what you type, turns a pasted training plan into templates, suggests an exercise's muscles and the pose of progress photos you import, describes your week, and turns questions about your log into a search the app runs. It runs entirely on your phone through Google's AICore service. What you log, type or photograph for it isn't sent to us or to Google. Google may collect anonymous usage metrics about the AI service itself, under Google's privacy policy. You can turn it off in Setup > App settings.
Assistant
The full app's Assistant is a chat inside the app. It answers by looking things up in your log on your phone; with on-device AI turned on, Gemini Nano only helps it understand your question and put your week into words, on the phone. Your chats are kept on your phone with the rest of your log and are included in your backups. Nothing you ask or that it answers is sent to us or anyone else.
Camera and shared images
The full app's Photo booth uses your phone's camera to take progress photos. The camera picture is only shown on your screen and saved on your phone when you tap Save; it isn't recorded or sent anywhere. Images and videos the app makes for you to share (Rewind's then-and-now image and timelapse, and the check-in for your coach) are made on your phone and only go where you send them. The coach check-in leaves out your protocol and blood tests unless you switch them on.
Google Drive backups
If you turn them on, backups go to your own Google Drive, optionally encrypted with a password only you know. We can't read them. Google's privacy policy applies to your Google account.
Health Connect and maps
The app reads the Health Connect data types you choose, only to show them to you on your phone. It doesn't write to Health Connect, and the data isn't sent anywhere. When you view a route, map tiles are loaded from OpenStreetMap, which sees the map area requested.
Security and breaches
Licence data is stored with Cloudflare, protected by access controls, and our admin tools need two separate logins. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC).
Your rights
You can ask what we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. We'll reply within 30 days. Deleting your licence record means it can no longer be activated.
If you're not happy with how we handled a privacy matter, tell us first. You can also complain to the OAIC at oaic.gov.au.
Age
The app and this website are for people aged 18 or over.
Changes
If this policy changes, we'll update the date above and note the change in the changelog.